Microsoft Defender Is On the Job
March 22, 2022
I don’t know if this write up is an early April Fool thing or actual factual. “Microsoft Defender Goofed Up As It Flagged Its Own Office Updates As Malware” states:
…the company’s Defender for Endpoint security started detecting updates for its own Office app as ransomware. The antivirus program was misidentifying the “OfficeSvcMgr.exe” as malicious software.
Let’s assume there is some truth in the statement OfficeSvcMgr.exe is malicious. My ideas are:
- Careless Microsoft coding was part of OfficeSvcMgr.exe and less flawed coding by another Microsoft technical group spotted the “flaw”
- Microsoft’s quality assurance for its “security” systems remains questionable and the business process flaws have not yet been remediated
- Microsoft is busy adding features to Teams and ads to File Manager so there’s no time or resources to deal with the outstanding Defender service.
Which is closer to the pin? I am into the flawed business processes. But the appeal of putting ads into an operating system is a close second.
Stephen E Arnold, March 22, 2022
Insider Threat News: Two Interesting Situations at Two Sophisticated Companies
March 21, 2022
As you may know, I enjoy pointing out that some big buck cyber security systems struggle with insider threats. Isn’t it easier to put the words “detect and prevent insider threats” on a marketing slide deck than implement the service?
Two events may serve to remind those who wonder about the risks insider threat pose.
First, “Microsoft Investigating Claim of Breach by Extortion Gang” explains that a bad actor entity advertised for insiders. This quote is from the cited article:
We recruit employees/insider at the following!!!! Apple, IBM, and Microsoft. TO NOTE: WE ARE NOT LOOKING FOR DATA, WE ARE LOOKING FOR THE EMPLOYEE TO PROVIDE US A VPN OR CITRIX TO THE NETWORK, or some anydesk.
If accurate, this group (LKAPSUS$) is clear about the why and what it wants. The article alleges that Microsoft is beavering away to determine if its systems have been breached. Don’t the Softies use Defender and other MSFT cyber defense services? Yeah, well.
Second, Apple made headlines because an insider spoofed Apple’s security to the tune of an alleged $10 million. “Former Apple Employee Charged with $10M Fraud” reports:
… Prosecutors allege that while Prasad negotiated with suppliers and entered invoices into the purchasing system, he was conspiring to take kickbacks, using false repair orders to steal parts, and paying for goods and services never received using Apple’s money. The charges go on to allege tax evasion, wire and mail fraud, defrauding the United States, and money laundering, noting that Prasad was fired from Apple in December 2018 after a decade of employment.
How about those internal security and auditing business processes? Apple cares about privacy and security is the firm’s assertion. Again: Marketing is easier than preventing an insider threat.
Why am I bringing up a subject which is not discussed in the specific context of expensive cyber security systems? I offer these examples to make clear that what a cyber outfit says and what its products and services do are less reliable than a decade AvtoVAZ LADA. If you are not familiar with these vehicles, try to find one to drive on a long road trip through the Rocky Mountains. No LADA? Go for a Renault.
Stephen E Arnold, March 21, 2022
The Promise of Curated Apps
March 17, 2022
It is much easier to describe something than it is to produce a thing that matches the slide deck. I am not sure if the information in “Vicious SharkBot Banking Trojan Discovered in Play Store Antivirus App” is spot on. The tip off for me is the description of malware as “vicious.” The metaphors of sharks, apps, and vicious don’t work, but I get the idea.
The main point of the write up strikes me as:
British IT security researchers discovered, an updated SharkBot is hiding inside an innocent-looking antivirus app which is still available on the Google Play Store as of Saturday.
The interesting function is that the malware includes a function which performs automatic transfers. The money is in an account until it is not.
How does one obtain the app? The write up alleges that one might visit the Google Play Store and download something called Antivirus Super Cleaner.”
If the story is accurate, one has to consider this question, “Who is the minder of the Google Play Store?” An intern, a snorkeling bit of smart software, a contractor obtained via Upwork, a full time employee looking for a lateral arabesque to a hot new project, no one, or some other mechanism?
Imagine. No one minding the store. A new approach to curation perhaps?
Stephen E Arnold, March 17, 2022
Cyber Security Mumbo Jumbo: Whatever Sells to MBAs Is Good
March 15, 2022
Malware analysis is an important business function, but companies are confused about how it helps. Venture Beat examines how many companies have trouble with malware analysis in the article: “Report: 93% Of Orgs Challenged By Malware Analysis.” OPSWAT released a startling report about how companies respond to malware analysis. The results that 93% do not know what to do or lack effective and efficient operations is not good.
The biggest challenges companies face when handling a potential threat are lack of automation, lack of integration, and lack of employee experience with tools. These slow down response time to attacks and could potentially create bottlenecks.
This is even more disturbing because only 3% of companies resolve malware attacks, while 22% resolve less than half. Advanced persistent threats (APTs), targeted attacks, and ransomware bad actors are increasing and malware analysis is a way to prevent them.
“Malware analysis is a time-consuming manual process, made all the more complex by tools that are not integrated. Such monotonous workflows can become the source of employee burnout, or introduce human error into the process, making the demand for high-performance and accurate solutions a premium. The technical limitations of malware analysis and the struggle to find experienced malware analysts are two sides of the same coin, and if malware analysis is to continue maturing as a business function, then organizations need to be aware of their current limitations and begin investing in more automated, integrated, and accurate solutions — resulting in a stronger security posture and higher performing staff.”
Companies should be aware of malware attacks and take preventive measures, such as those outlined in malware analysis reports. Is investing in malware analysis well spent, though, if companies do not do anything? Maybe it would be better to teach employees how to recognize potential threats or investing in decent cyber security.
Whitney Grace, March 15, 2022
Google and Mandiant: Will Google Be Able to Handle a People Business?
March 11, 2022
Talk about Google’s purchasing Mandiant is a hot topic. I want to comment about Protocol’s article “Google Wants to Be the Full-Service Security Cloud.” The write up is one of several mentioning an important fact:
The company currently has 2,200 employees, including 600 consultants and 300 intelligence analysts who respond to security breaches.
Mandiant, therefore, has about half of its employees performing consultant type work. Not long ago, Google benefited from the sale of Recorded Future, a company which was in the cyber security business AND had a capability that Google had not previously possessed. What was Recorded Future’s magic ingredient? My answer is, “Ability to index by time.” There were other Recorded Future capabilities. In-Q-Tel found the company interesting as well.
Now the Google is embracing the consultative business in which Mandiant has done well. How will the Google management method apply to the individuals who make up about half the Mandiant work force?
If the past is an indication, Google does okay when the staff are like Google’s previous and current management. Google does less well when the professionals are less like those high school science club members who climbed the ladder at the Google.
To sum up: This deal is going to be interesting to watch. Microsoft is likely to be keen on following the tie up. Mandiant is, as you may recall, the outfit which blew the whistle on the SolarWinds’ misstep. Microsoft was snagged in the subsequent forensic analyses. Plus, the cyber security industry is enjoying some favorable winds. The issue, however, is that as threats become breaches, the flaws of the present approach to cyber security become more obvious. Online advertising, cloud computing, and cyber security — a delightful concoction or a volatile mix?
Stephen E Arnold, March 11, 2022
Cybersecurity and Human Error. Pesky Humans
March 10, 2022
Workers make honest mistakes. And sometimes those mistakes lead to security breaches. Darktrace describes how to guard against human imperfection in its DarkReading blog post, “Insider Threats Are More than Just Malicious Employees.” There is the worker who implements a shortcut they believe is benign but actually opens a route for attack. Another may simply forget everything they were taught in security training. Then there is the employee who is more focused on their next gig than on maintaining security practices at a firm they are leaving.
One answer to such risks, writes features editor Fahmida Y. Rashid, is zero trust. Though it sounds cynical, the practice protects organizations from human error. Citing Darktrace threat analyst Toby Lewis, Rashid explains:
“Zero trust treats every connection and action as suspicious. There are signals to verify, such as the device being used, the time of the day, and the order of applications being accessed. If the user is straying outside what’s expected, it triggers an investigation, even if the activity is originating from inside the environment. … In a zero-trust organization, it would be harder for insiders to act badly, Lewis notes. By managing identity, security teams understand who the users are and determine what ‘normal’ looks like. This way, they can assess the level of risk for each person and get a sense of when to ask for more information.”
Network segmentation is the other suggestion. We learn:
“If the network has been divided into different compartments, then users have to authenticate each time they cross into a new area. Different parts of the network can be carved out based on risk and where sensitive data is stored. ‘Each part of your network should be behind its own set of locked doors,’ Lewis says. ‘You could only cross this barrier if you are a trusted person.’”
In an ideal world, workers would reliably adhere to best practices and security teams would have no reason to track employees’ work patterns. But since we are stuck in this imperfect world, companies must do what they can to guard against human imperfection.
Cynthia Murrell, March 10, 2022
Google: Defines Excellence for Android Users
March 3, 2022
I read a hoot of a story. “Data Stealing App Found in Google Play Downloaded Thousands of Times.” The idea for branded stores is consistency, compatibility, and trust. No one wants to buy an air fryer that explodes and maims an influencer. Why would one want to download a mobile app which allows a bad actor to seize data or control of one’s mobile device.
The write up reports:
A notorious Android banking trojan designed to steal user data, like passwords and text messages, has been discovered in Google Play and downloaded thousands of times. The TeaBot banking trojan, also known as Anatsa and Toddler, was first observed in May 2021 targeting European banks by stealing two-factor authentication codes sent by text message.
Yep, malware direct from the Google. Let’s rundown those qualities of a branded store:
- Consistency
- Compatibility
- Trust
Check, check, and check.
Ah, Google, are you entering a security drag race against the Softies?
Stephen E Arnold, March 3, 2022
Microsoft and Security: A Probably Trivial Item
March 2, 2022
An online publication called Venture Beat published “Russia May Use SolarWinds-Like Hacks in Cyberwar over Ukraine.” The article contained a paragraph I found suggestive. Here’s the passage:
…the attackers are believed to have gained access for as much as nine months to numerous companies and government agencies, including FireEye, Microsoft and the Departments of Defense, State and Treasury.
The point for me is that the extent of the breaches is not fully known. It is easier to issue news releases and make high-profile marketing moves than come to grips with the allegedly accurate information in the Venture Beat article.
Stephen E Arnold,March 2, 2022
Microsoft: The Security Supremo Cloud Pitch
February 28, 2022
I read “Microsoft’s New Security Chief Says It Is Time to Take Shelter in the Cloud.” The write up reports:
Microsoft has been hit by a series of high-profile cyber intrusions in recent years. In December 2020, the company said it had been compromised by the hackers behind the cyberattack on SolarWinds Corp.—a group that U.S. officials have linked to the Russian government. Months later, Microsoft’s widely used email product, Exchange, was targeted by a cyberattack that was eventually linked to the Chinese government.
I know. So now Microsoft wants me to trust their cloud service because it is more secure?
What’s interesting is that a former Amazon AWS executive is in charge. Apparently he has addressed assorted security concerns. He is, if true, a fast worker or a faster PR content generator.
The write up points to February 22, 2022, as the day it asserted it would repurpose the Microsoft security products for the Google cloud. Keep in mind that Microsoft security is compatible with Amazon’s cloud.
The write up includes this statement:
In addition to the SolarWinds and Exchange cyberattacks, the company in August had to repair a flaw in the Azure cloud—strategically Microsoft’s most-critical business—after a cybersecurity company found a bug that left customer data exposed. The Azure bug, which was discovered by the cybersecurity company Wiz Inc., rattled some Microsoft customers because it showed how hackers could steal data from thousands of customers by targeting one part of Microsoft’s cloud.
Saying security is different from delivering security. In some ways, Microsoft’s penchant for distraction with the wonky Windows 11 release and then the super spectacular metaverse game type thing have worked.
Now security is back in the spotlight. Oh, just move everything to the cloud. Lock in? Yep. More expensive? For some yes. Put all the eggs in one basket with some security issues? Sure, that makes perfect sense.
If you are doubtful about the cloud, navigate to “Report: 76% of IT Pros Say That Cloud Has Hit a Wall.” The main idea of that write up is that
multicloud, multitool environments have outgrown the tools and platforms that IT leaders currently rely on.
That’s what’s interesting about the Microsoft security PR. Flawed software? Seems possible.
Remember SolarWinds? Remember Exchange Server?
Stephen E Arnold, February 28, 2022
How to Be Happy the Microsoft Way: Endorsed by the Harvard Business Review?
February 25, 2022
I read a fascinating article about being happy. “A Microsoft Exec Says Tech, Not People, Makes Employees Really Happy” recycles an article from the estimable Harvard Business Review published an article titled “In a Hybrid World, Your Tech Defines Employee Experience.” I want to be upfront. I find most of the information in the HBR focused on authors hawking some type of consulting expertise. The outputs in the HBR acted like a magnet on blue chip consulting firms. Getting an article in the HBR was the equivalent of getting Elvis Presley to throw a perspiration tinged scarf to an adoring fan.
According to the source recycling the HRB information about being happy, I noted these statements of Delphic grade insight minus the blood of a dove, a goat, and possibly a misbehaving acolyte.
- Employee experiences are defined by technology.
- Technology and workplace tools are the new workplace. [HBR apparently likes this type of repetition]
- “Technology is “becoming central in attracting and retaining new talent, fostering workplace culture, creating productivity, and more.”
I want to offer some of my personal happy experiences with Microsoft technology:
- Updates which kill functions; for example, a system cannot print. This makes me happy for sure.
- Posturing about security when the vulnerabilities spawned by Microsoft software thrill bad actors each and every day.
- Microsoft Word’s remarkable ability to move images in delightful ways.
- The shallow spidering of the just so wonderful Bing content processing system.
- Rumors and allegations about Bill Gates and his interesting interactions with other Microsoft professionals
- A foldable phone with weird performance characteristics for two-screeners with good eyes
- Microsoft WiFi hardware which a Softie told me, “Doesn’t work.”
- Meaningless features in a screen capture utility
- Did I mention Exchange Server vulnerabilities? Yeah.
- And Teams for those using a Mac without a Microsoft 365 subscription. That’s a thrill.
I recall one meeting at which a senior Softie took an iPhone from an employee in a meeting with lots of people in the audience. I recall the baffled looks on the faces of Microsoft Research experts when I asked for a show of hands for those who were familiar with Kolmogorov’s approach to probability. No hands went up. Bummer. I recall a mobile meeting in which I was told, “Mobiles will never have multiple radios.”
Ah, memories.
But the HBR write up explains that my experiences would make me happier via technology.
Yeah, right. Thoughts from the Microsoft person who pointed the finger at a 1,000 engineers directed by a nation state to compromise Citadel Windows. Yep, that person.
Stephen E Arnold, February 25, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
